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INTRODUCTION 


Most  precision  munitions  operate  safely  and  as  designed.  If  structures  fail,  they  buckle, 
yield,  crack,  or  do  not  move  as  designed.  Figure  1  shows  a  yield  failure  in  a  normally-flat  mortar 
fin.  Root  cause  investigation  showed  that  unequal  pressures  on  different  sides  of  the  fin  caused 
high  bending  stresses  in  the  fin  and  yield  failure  (ref.  1).  Figures  2  and  3  show  the  fracture 
failures.  The  failure  in  figure  2  was  caused  by  a  critical  defect  at  a  press-fit  interface.  The  crack 
shown  in  figure  3  occurred  at  a  nearly  square  slot.  Root  cause  investigation  indicated  that  the 
slot  was  roughly  equivalent  to  the  critical  defect  size. 


Figure  1 

Yield  failure  in  a  mortar  fin  (ref.  1 ) 


Figure  2 

Fracture  failure  near  a  mortar  fin  (ref.  1 ) 
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Figure  3 

Fracture  failure  near  a  slot 

Gun-fired  munitions  have  two  statistical  requirements  that  affect  structural  design.  First, 
munitions  are  designed  to  meet  operational  reliability.  Excalibur,  for  instance,  is  expected  to 
have  an  operational  reliability  exceeding  96%.  Second,  gun-fired  munitions  are  designed  so  that 
failures  do  not  damage  the  gun  or  put  our  soldiers  at  risk  of  injury.  For  Excalibur,  the  number  of 
allowable  safety  failures  is  less  than  1  in  one  million. 

This  paper  describes  analysis,  design,  and  development  methods  to  meet  the  operational 
and  safety  goals  for  structural  components.  The  methods  incorporate  statistical  variations  rather 
than  safety  factors.  Detailed  failure  criteria  and  step-by-step  procedures  for  damage  tolerant 
design  are  presented.  Redesign  guidelines  for  early  failures  are  presented. 

The  methods  were  developed  from  dozens  of  root-cause  failure  investigations  and 
redesigns.  Most  of  the  investigations  were  based  on  the  Army’s  Sense  and  Destroy  Armor 
(SADARM),  Excalibur,  and  mortar  programs.  SADARM  was  a  155-mm  smart  sub-munition 
projectile.  Although  the  SADARM  program  was  cancelled  in  2001  because  the  reliability  was 
77%  versus  a  requirement  of  80%,  approximately  300  M898  SADARM  projectiles  were 
successfully  deployed  in  2003  during  Operation  Iraqi  Freedom.  Excalibur  is  the  current  155-mm 
precision  guided  projectile,  in  the  later  stages  of  design  and  development  in  2006.  The  mortars 
programs  are  mature  production  programs  that  have  experienced  launch  anomalies.  This  paper 
includes  examples  from  all  three  programs. 


ANALYSIS  METHODS  FOR  GUN-FIRED  STRUCTURES 
Systems  and  Sub-systems 

Parts  and  sub-systems  are  divided  into  one  of  two  categories:  mission-critical  parts  and 
safety  critical  parts.  All  parts  are  assumed  to  be  mission  critical  and  are  designed  to  operate 
after  statistically  expected  applied  loads.  Mission-critical  parts  are  designed  to  resist  buckling 
and  yielding. 
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Safety  critical  parts  are  structural  members  whose  failure  would  result  in  damage  to  a  gun 
or  injury  to  a  soldier.  Safety-critical  parts  must  be  damage  tolerant.  For  Excalibur,  safety-critical 
parts  include  the  projectile  base  and  walls.  Parts  within  the  projectile  whose  damage  results  in 
failure  of  the  projectile  walls  are  also  safety  critical  parts.  Low  mass  parts  and  contained  parts 
are  not  considered  safety  critical.  For  the  most  part,  this  definition  of  safety  critical  parts  is 
consistent  with  the  NASA  Technical  Standard  for  the  Space  Shuttle  Payload  (ref.  2). 

Gun-fired  munitions  are  complicated  assemblies  with  multiple  parts,  complex  geometries, 
and  non-linear  behavior.  Excalibur  for  instance,  has  well  over  1 000  parts,  if  one  includes  solder, 
computer  chips,  wires,  and  supporting  structures.  The  geometry  is  generated  in  Pro/Engineer 
(ref.  3).  From  Pro/Engineer,  *.stp  files  are  written  as  input  for  finite  element  analysis.  Finite 
element  analysis  is  usually  completed  on  subassemblies.  Wires  are  not  included  in  the 
analysis.  Bolts  are  rarely  modeled.  Threads  are  not  included  in  the  assemblies,  but  may  be 
evaluated  separately  in  focused  finite  element  models.  Holes  and  notches  are  retained  in  high- 
stress  areas.  For  subsystems  with  populated  circuit  boards,  the  solder  is  required  to  correctly 
model  strength,  stiffness,  and  frequencies  of  the  populated  circuit  boards.  O-rings  and  dampers 
are  included  in  the  analysis  of  sensors  and  mechanisms. 

The  modeling  of  threaded  components  usually  presents  an  issue.  To  simplify  the  model,  it 
was  stated  that  the  threads  are  not  modeled  and  the  surfaces  are  tied.  This  can  artificially 
stiffen  the  structure  at  times  or  can  change  the  load  path.  The  best  way  to  handle  this  situation 
is  to  build  a  two-dimensional  model  with  the  threads  modeled  explicitly.  The  threads  are  usually 
modeled  without  the  helical  twist  unless  it  is  absolutely  necessary.  If  the  helix  is  required,  then 
the  threads  must  be  modeled  in  a  three-dimensional  model.  These  results  can  then  be 
compared  to  the  simplified  model  to  see  the  effect  of  the  different  geometry. 

Software  Packages 

Design  requires  accurate  prediction  of  stress,  strains,  displacements,  and  critical  defect 
sizes.  For  most  analysis,  the  Army’s  Excalibur  team  uses  Pro/Engineer  (ref.  3)  for  solid 
modeling,  NASGRO  (ref.  4)  for  estimating  critical  defects,  and  UniPass®  (ref.  5)  for  estimating 
structural  reliability.  For  finite  element  analysis,  the  team  uses  ABAQUS  (75%),  ANSYS  (20%), 
or  DYNA  (5%)  (refs.  6  and  7).  ABAQUS  is  preferred  because: 

•  Parts  can  be  de-featured  and  re-featured 

•  Explicit  or  Implicit  dynamic,  static,  or  modal  analysis  can  be  completed  with  only 
small  changes  to  the  model 

•  Parts  can  be  replaced  with  redesigned  parts  in  an  assembly 

•  Elastic-plastic  material  and  buckling  are  easy  to  evaluate 

•  Contact  in  ABAQUS  Explicit  is  automatic  and  easy  to  implement 

•  Actual  acceleration  curves  can  be  used  as  applied  loads 

•  The  new  (2005)  fracture  capabilities  can  be  used  to  predict  critical  flaw  sizes  in 
highly  stressed  areas  where  linear  elastic  fracture  mechanics  may  not  be  sufficient 
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Finite  Element  Models 


Early  Analysis 

Finite  element  analysis  is  used  to  evaluate  the  ‘actual’  assembly.  To  the  extent 
possible,  the  analysis  is  the  final  geometry.  Geometric  changes  late  in  the  design  process  are 
more  difficult  to  accommodate  in  the  finite  element  model. 

Symmetry 

Most  finite  element  analyses  are  completed  on  three-dimensional  models. 

Symmetry  is  used  when  geometry,  loads,  and  materials  are  symmetric  or  nearly  so.  Half-models 
are  required  if  transverse  loads  or  blow-by  are  considered.  For  sensors  and  mechanisms  that 
are  not  symmetric,  the  full  model  is  evaluated.  For  threaded  connections  and  joints,  axi- 
symmetric  models  are  often  used  to  check  details  that  would  otherwise  be  too  costly  to  include 
in  a  three-dimensional  analysis. 

Meshing 

ANSYS  and  ABAQUS  both  have  automatic  meshing  ability.  In  ANSYS,  the 
Structural  Error  option  is  checked  and  corrected  until  it  is  below  10%.  In  ABAQUS,  maximum 
artificial  strain  energy  is  usually  checked  for  each  part  and  corrected  if  it  exceeds  more  than 
about  10%  of  the  strain  energy  in  the  part.  When  possible: 

•  Parts  are  modeled  as  8-node  brick  elements.  For  regions  that  cannot  be 
meshed  into  brick  elements,  10-node  tetrahedral  elements  are  used. 

•  Projectile  walls,  circuit  boards,  and  other  parts  with  bending  are  modeled 
with  at  least  four  brick  elements  through  the  thickness.  If  mesh  refine¬ 
ment  is  in  order,  an  even  number  of  elements  are  modeled  in  the 
thickness  direction. 

•  If  plasticity  occurs,  the  mesh  is  refined  until  at  least  five  elements  have 
plastic  strain. 

•  Contour  plots  are  checked  to  verify  that  variations  within  elements  are 
small.  The  von  Mises  stress  and  the  stress  components  are  compared 
with  and  without  averaging. 

Material  Models 

In  the  absence  of  statistical  material  properties,  analysis  uses  the  strengths  and 
stiffness  from  “Metallic  Materials  Properties  Development  and  Standardization”  (ref.  8). 
Properties  are  chosen  as  A-basis  minimum,  which  corresponds  to  95%  confidence  limit  on  1% 
of  the  distribution  (ref.  9).  Consideration  of  component  size  and  manufacturing  process  are 
accounted  for  when  picking  material  strengths  and  elongations. 
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For  safety-critical  parts,  the  yield  strength,  ultimate  tensile  strength,  elongation,  and 
fracture  toughness  are  part  of  the  component  specification.  Parts  are  tested  for  compliance 
using  ASTM  Standards  E-8  or  ASTM-E399  (ref.  1 0).  Parts  that  do  not  meet  strength  and  tough¬ 
ness  requirements  are  discarded  or  marked  for  firing  at  a  lower  charge.  IThis  is  only  allowed 
under  controlled  developmental  test  conditions.)  If  the  material  does  not  meet  strength  or 
toughness  requirements  during  production  the  material  is  scrapped.  It  should  be  noted  that 
Rockwell  hardness  does  not  always  correlate  well  with  strength.  Rockwell  hardness  is  an 
indication  that  the  material  was  heat  treated,  not  that  the  strength  meets  specification 
requirements.  Hardness  is  not  used  as  acceptance  criteria. 

If  statistical  analysis  is  available,  statistically-lower  values  are  used  instead  of 
handbook  values.  For  4340  ASM  6414  steel,  for  instance,  reference  8  specifies  a  yield  strength, 
ultimate  tensile  strength,  and  elongation  of  1498  MPa,  1795  MPa,  and  10%,  respectively.  For 
Excalibur,  strengths  of  1416  MPa,  1623  MPa,  and  5.4%  were  used  for  initial  design.  Table  1 
shows  the  results  of  early  material  tests.  Data  was  from  different  vendors  and  on  different 
structural  components.  Even  with  the  lower  allowable  values,  parts  were  fired  at  reduced 
charges  when  8/66  prototypes  had  lower-than-required  yield  strengths. 

Table  1 

Tested  material  properties  of  4340  steel 


Yield  strength 

Tensile  strength 

Elongation 

Fracture  toughness 

MPa 

MPa 

% 

MPaVm 

(No.  of  samples) 

(66) 

(66) 

(64) 

(60) 

Average 

1501.6 

1861.4 

11.6 

52.2 

Standard  deviation 

78.07 

129.88 

0.02 

11.98 

Coefficient  of  variation 

0.052 

0.070 

0.19 

0.230 

Minimum  required 

1416 

1623 

5.4 

45 

Handbook  (ref.  8) 

1498.4 

1795.3 

10 

No.  below  minimum 

8 

2*  very  close 

0 

13 

The  statistics  are  also  used  to  improve  the  material  properties.  For  the  results  in 
table  1,  the  lower  fracture  toughness  corresponded  to  higher  phosphorous  and  sulfur  contents. 
Toughness  was  improved  by  removing  material  lots  with  sulfur  and  phosphorous  exceeding 
0.015%. 


Yield  strength,  ultimate  tensile  strength,  and  elongation  values  are  modeled  using 
multi-linear  stress-strain  behavior.  In  ANSYS,  the  ‘miso’  option  is  used  for  elastic/plastic  metals 
and  the  engineering  strength  and  elongation  values  are  used.  In  ABAQUS,  the  engineering 
values  are  converted  to  true  stresses  and  strains.  Figure  4  shows  the  stress/strain  diagram  for 
ABAQUS  and  4340  steel  components.  The  stress-strain  behavior  flattens  at  the  ultimate  tensile 
strength.  If  a  bilinear  model  is  used  instead,  the  stress  may  increase  beyond  ultimate  tensile 
strength. 
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Steel  4340,  ABAQUS  Material  Model 


Figure  4 

Steel  4340  material  model,  ABAQUS 


Internal  Constraints 

Internal  constraints  are  a  source  of  uncertainty.  Assumptions  about  internal  con¬ 
straints  can  result  in  stress  variations  as  high  as  50%.  Threaded  joints  are  often  modeled  as 
tied  surfaces.  Other  surfaces  are  modeled  as  contact  surfaces.  Bolted  connections  are  tricky  - 
with  uncertainty  as  to  what  part  of  the  surfaces  stay  in  contact  over  time.  Most  of  the  time,  bolted 
connections  are  modeled  as  combined  tied  and  contact  surfaces.  Analyses  are  often  checked 
using  different  constraint  assumptions  to  bracket  the  solution. 

Gun-fired  munitions  have  many  parts  and  many  contact  surfaces.  Since  contact  can 
be  modeled  automatically  in  ABAQUS  Explicit,  static  analyses  are  completed  as  quasi-static. 
Quasi-static  loads  are  ramped  up  using  the  'smooth'  option  in  ABAQUS  Explicit.  The  time 
required  for  loading  is  about  0.003  sec  or  lOx  the  lowest  natural  frequency  of  interest.  For  most 
contact,  friction  is  neglected. 

Applied  Loads,  Mission  Critical  Parts  and  Subsystems 

For  the  Army’s  Excalibur  projectile,  all  parts  are  designed  to  operate  after  a  load  5% 
higher  than  can  be  statistically  expected,  the  Army’s  ‘PMP  +5%’  load.  Permissible  maximum 
pressure  (PMP)  +5%  refers  to  105%  of  the  PMP  in  a  weapon  as  defined  in  International  Test 
Operating  Procedure  (ITOP)  4-2-504.  Permissible  maximum  pressure  coincides  with  a  3-sigma 
upper  limit  on  the  service  charge  conditioned  to  +145°F.  Statistically,  PMP  load  occurs  13  in 
10,000  firings  and  PMP  +5%  occurs  slightly  under  one  in  a  million  firings  (refs.  1 1  and  12). 
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Applied  Loads,  Accelerations  in  the  Gun  Tube 

Figure  5  shows  measured  accelerations  from  an  on-board  recorder  on  Excalibur, 
PMP  +5%  charge.  Accelerations  were  recorded  in  three  perpendicular  directions  at  a  location 
about  two-thirds  of  the  distance  from  the  base  of  the  projectile.  During  set  back,  the  maximum 
pressure  occurs.  After  set  back,  the  projectile  passes  the  bore  evacuator  where  a  pressure 
pulse  occurs  (ref.  13).  During  muzzle  exit,  the  projectile  exits  the  gun  tube  and  the  pressure 
drops  to  zero.  After  the  pressure  drops,  the  projectile  oscillates  about  its  center  of  mass  [fig.  6 
(ref.  14)].  The  recorded  accelerations  can  be  used  as  applied  loads  on  subsystems  near  where 
the  data  was  recorded. 


-  OBR3  Axial 

OBR3  Radial  1 
OKR3  Radial  2 

XMIN  1.840E-06 
XMAX  1.238E-02 
YMIN  -3.884E+03 
YMAX  1 . 330E+04 


- 1 - 

Set  Back 


Figure  5 

Recorded  acceleration,  Excalibur,  and  illustration 
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Equilibriunr position  of  the  C.G. 


C.G  moves  rearward  with  compression. 


Axial  Force 


C.G.  back  to  equilibrium  position  -  structure  exhibits  damped  oscillation  about  C.G. 
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Figure  6 

Muzzle  exit  behavior  as  pressure  drops 


For  Excalibur,  10  early  shots  were  made  at  the  PMP+5%  charge  level.  For  the  10 
shots,  the  coefficient  of  variation  on  the  maximum  axial  acceleration  was  about  0.1 .  For  muzzle 
exit,  the  coefficients  of  variation  for  the  axial  and  transverse  accelerations  were  0.47  and  0.43, 
respectively.  Variations  in  the  muzzle-exit  dynamics  can  be  attributed  to  a  drop-off  of  pressure 
as  the  projectile  passes  the  bore  evacuator  and  nears  the  end  of  the  tube.  At  muzzle  exit,  the 
constraint  on  the  structure  changes  as  the  projectile  goes  from  support  at  two  bourrelets,  to 
support  at  one  bourrelet,  to  free  flight.  The  coefficients  of  variation  for  set  back  and  muzzle  exit 
were  typical  of  other  charge  levels  for  Excalibur  (ref.  15). 


Recommended  Design  Loads,  Static  Analysis 

Statistical  variations  should  be  considered  for  safety-critical  parts  or  if  reliability  is  a 
key  design  parameter.  Statistics  can  be  determined  from  analytic  models  and  a  design  of 
experiments  or  they  can  be  derived  from  experimental  data.  As  an  example,  the  following  load 
cases  were  derived  from  Excalibur  test  data: 


Case  1.  Set  back,  maximum  axial  acceleration  plus  transverse  acceleration  in  the 
worst  direction.  For  Excalibur  for  instance,  the  99%  confidence  values  were  determined  from  10 
live-shots.  For  Excalibur,  the  set  back  loads  include  simultaneously  (ref.  11): 

•  Axial  Acceleration:  16,566  g’s 

•  Transverse  Acceleration:  707  g’s 
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Case  2.  Muzzle  exit,  minimum  axial  acceleration  and  maximum  transverse 
acceleration.  For  Excalibur,  the  99%  confidence  values  for  muzzle  exit  are  both  (ref.  11): 

•  Axial  Acceleration:  -5569  g’s 

•  Transverse  Acceleration:  6100  g's 

Case  3.  Blow-by,  maximum  axial  acceleration  plus  blow-by  along  the  projectile 
structure.  For  Excalibur,  a  subcontractor  supplied  a  blow-by  curve  as  a  function  of  distance 
along  the  projectile.  For  analysis,  blow-by  was  applied  to  90/360  deg  on  the  assembled 
structure.  A  half-model  was  used  for  analysis. 

Case  4.  Spin-stabilized  projectiles  may  require  additional  load  cases.  Angular 
acceleration  should  be  added  to  the  case  1 ,  set  back  and  angular  velocity  should  be  added  to 
case  2,  muzzle  exit. 

Case  5.  There  are  non-symmetric  pressures  in  a  gun  tube.  The  mortar  damage  in 
figure  1  resulted  from  non-axi  symmetric  pressures.  Pressure  transducers  around  the  120-mm 
mortar  fins  showed  pressure  variations  as  high  as  14  MPa  over  the  360  deg.  Similar  variations 
in  pressures  were  measured  around  an  instrumented  155-mm  projectile,  XM1073  (ref.  16). 

For  components  such  as  fins,  additional  load  cases  may  be  required. 

Recommended  Design  Loads,  Dynamic  Analysis 

Typically,  dynamic  analysis  occurs  after  prototype  development  and  when  test  data 
is  available.  Dynamic  analysis  is  required  for  parts  with  natural  frequencies  near  the  loading 
frequencies.  For  Excalibur,  dynamic  analysis  was  completed  for  all  sensors  and  circuit  boards. 
Dynamic  analysis  is  also  required  for  all  mechanisms  and  sub-systems  with  moving  parts. 
Numerous  dynamic  load  patterns  were  applied  to  the  fuze  Safe  and  Arm  device  on  the  Excalibur 
program.  For  parts  that  yielded  under  the  set  back  load,  dynamic  analysis  was  also  completed. 
The  repeating  loads  that  occur  during  muzzle  exit  can  cause  reversals  in  the  stresses,  an 
increase  in  the  damage  zone,  and  component  failure. 

The  direction  of  the  transverse  loads  is  unknown.  For  non-symmetric  sensors  and 
mechanisms,  transverse  loads  are  applied  in  eight  different  directions.  The  stress  variation  is 
used  to  estimate  the  reliability  of  electronic  components. 

Reality  Check  and  Feed  Back 

To  the  degree  possible,  the  analyst  needs  to  understand  the  design,  the  function  of 
all  of  the  parts,  and  the  interactions  between  parts.  When  the  analyst  is  not  the  designer, 
iterative  evaluations  are  expected  and  feedback  is  required.  Contractors  and  the  design  teams 
should  review  the  results,  verify  that  the  displacements  are  reasonable,  validate  load  paths, 
compare  results  to  actual  firings,  and  determine  if  failure  is  likely. 
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STRUCTURAL  FAILURE  CRITERIA 


Once  the  analysis  is  complete,  the  results  are  reviewed  to  determine  if  1)  the  results  are 
realistic  and  2)  failure  is  likely.  Three  types  of  structural  failure  are  considered:  buckling, 
yielding,  and  fracture. 

Buckling 

Buckling  is  an  elastic  instability  occurring  under  compressive  forces.  Buckling  is  auto¬ 
matically  checked  with  ANSYS  or  ABAQUS  by  using  the  non-linear  geometry  option.  Since  most 
parts  are  imported  from  a  solid  model,  the  parts  are  numerically  non-symmetric.  Parts  that  are 
symmetric  would  require  a  small  (<0.01%  of  compressive  load)  side  load  to  initiate  buckling. 

Yielding 

Projectiles  are  used  one-time  and  are  allowed  to  yield.  Two-yield  criteria  are  used  for 
ductile  components: 

•  Total  strain  or  equivalent  plastic  strain  <  elongation 

•  And  plastic  strain  <  14  wall  thickness 

The  equivalent  plastic  strain  is  based  on  the  von  Mises  yield  criteria.  The  material  parameters 
yield  strength,  ultimate  tensile  strength,  and  elongation  are  specified  on  a  drawing  and  tested  in 
each  lot  for  compliance.  Multiple-use  parts  are  designed  with  stresses  below  the  yield  strength. 
Aluminums  are  often  modeled  as  orthotropic  materials  with  Hill’s  criteria  for  failure  (refs.  7  and 
17). 

Brittle  Materials 

Brittle  materials  are  modeled  as  elastic-only.  The  principal  stresses  are  compared  to 
material  strengths  using  the  Mohr-Column  criteria  (ref.  18).  Failure  in  capacitors  and  computer 
chips  is  based  on  the  maximum  bending  stress  and  the  probability  of  failure.  The  software 
package  Unipass®  is  used  to  predict  the  probability  of  failure  based  on  separate  stress  and 
strength  variations  (ref.  5). 

Fracture 

Safety  critical  parts  are  designed  to  prevent  fracture  failure.  The  critical  flaw  size  and  the 
associated  fracture  toughness  are  specified.  The  critical  flaw  size  is  determined  using  linear 
elastic  fracture  mechanics: 

KIC  >  Cyjac  *  a  *  f(a,W,B, D,t) 


where 


KIC  =  Fracture  toughness 

a  =  Normal  stress  component,  not  principal  stress 
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ac  =  critical  crack  size 

f(a,W ,B,D,t)  =  function  of  geometry 

The  fracture  toughness  KIC  is  chosen  as  a  statistical  low  value  and  verified  by  tests.  Details  of 
the  damage  tolerant  design  method  follow. 


DAMAGE  TOLERANT  DESIGN  FOR  SAFETY  CRITICAL  PARTS 
Overview,  Damage  Tolerant  Design 

In  damage  tolerant  design,  the  engineer  assumes  1 )  that  a  flaw  smaller  than  a  critical  size 
may  be  present  and  2)  the  munition  should  operate  safely  and  reliably  with  the  flaw  present. 

The  rate  of  flaws  is  relatively  low.  In  a  recent  mortar  projectile  sorting,  for  instance,  100%  of 
24,300  mortar  bodies  were  x-rayed  for  defects.  Fifty-nine  parts  had  defects.  All  defects  were 
smaller  than  the  critical  size.  Figure  7  shows  a  sample  with  a  defect. 


Figure  7 

Defect  in  a  mortar  body,  smaller  than  critical  size 

Figures  2  and  3  also  show  typical  sites  for  fracture  failure.  Figure  2  is  a  press  fit.  If  debris 
is  trapped  between  the  metal  surfaces,  sliding  the  parts  together  can  cause  a  critical  defect.  In 
figure  3,  the  critical  defect  corresponded  to  a  design  detail.  Damage  tolerant  design  could  have 
prevented  the  early  development  failure  that  occurred  at  eight  out  of  eight  rectangular  slots 
during  a  PMP+25%  Excalibur  firings. 

Method,  Damage  Tolerant  Design 

Critical  crack  sizes  are  estimated  using  the  linear  elastic  fracture  mechanics  assumptions. 
The  amount  of  plastic  deformation  is  assumed  to  be  small.  The  following  procedure  is  used  to 
estimate  the  critical  crack  size: 
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Step  1 ,  Complete  Stress  Analyses 

Finite  element  analysis  is  used  to  find  the  stress  distribution  in  the  safety  critical 
parts.  Several  load  cases  are  evaluated  to  determine  the  critical  case  for  different  locations.  The 
analysis  includes  material  and  geometric  nonlinearities. 

Step  2,  Record  Tensile  Stresses 

Normal  stresses  (not  principal  stresses)  are  recorded  at  high  stress  locations.  For 
cylindrical  components,  the  hoop  and  axial  stresses  are  required.  This  may  require  a  stress 
transformation  when  processing  the  results. 

Step  3,  Determine  Dimensions  at  Critical  Locations 

For  cylindrical  parts,  inner  and  outer  radius  is  required.  For  holes,  threads,  and 
notches,  other  dimensions  are  required. 

Step  4,  Estimate  Statistically  Low  Fracture  Toughness,  KIC 

A  number  of  references  give  for  fracture  toughness  values  (refs.  4,  8,  19,  and  20). 
For  4340  steel,  reference  4,  Version  3.0,  gives  a  chart  value  of  60  MPaVm,  reference  19  gives 
values  between  60  and  77  MPaVm  ,  and  reference  20  gives  Kfc  of  44.5  MPa-Vm.  “Metallic 
Materials  Properties  Development  and  Standardization  [MMPDS  (ref.  8)]  gives  toughness 
values  for  many  aluminum  and  titanium  alloys,  but  not  for  4340  steel.  Fracture  toughness 
variations  are  generally  higher  than  other  material  parameters.  If  available,  statistically  low  K/c 
values  are  chosen  to  minimize  waste.  The  preferred  toughness  reference  is  the  NASGRO 
program,  which  includes  statistics  on  toughness  for  common  aerospace  materials  (ref.  4).  The 
procedure  is  as  follows: 

•  Module:  Material  data  processing,  NASMAT  program,  toughness  data,  valid 
KIC  data  is  chosen 

•  For  the  correct  material,  entries  in  the  range  of  yield  and  ultimate  tensile 
strength  are  chosen.  For  4340  steel,  20  entries  were  used  to  find  the 
statistically  low  value.  Toughness  is  specified  as  the  average  value  minus  2 
standard  deviations.  For  4340  ASM  6414  steel,  the  toughness  was  chosen  to 
be  42  MPaVm.  Figure  8  shows  the  results  of  early  toughness  tests  on 
Excalibur  components.  Thirteen  of  60  samples  were  discarded  or  used  with  a 
lower  charge.  Once  the  early  test  data  was  available,  process  improvements 
were  implemented  to  reduce  material  variation. 
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Step  5,  Estimate  Critical  Crack  Dimensions 

Critical  crack  sizes  are  initially  predicted  assuming  standard  geometries  and  linear 
elastic  fracture  mechanics.  Linear  elastic  fracture  mechanics  is  valid  when  the  hoop  and  axial 
stresses  are  below  about  80%  of  the  yield  strength. 

Since  the  geometry  of  actual  parts  rarely  matches  a  theoretical  case,  a  number  of 
‘close’  geometries  are  evaluated  and  the  smallest  crack  size  is  chosen  as  critical.  Figure  9 
shows  a  typical  high-stress  location  in  a  cylindrical  component.  The  part  has  two  notches.  The 
highest  stresses  are  in  the  notch  and  the  stress  varies  through  the  wall  thickness. 
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Figure  9 

Tensile  stress  distribution  at  a  critical  location 

There  is  no  closed-form  solution  for  the  geometry  shown  in  figure  9.  Typical  ‘close’ 
crack  configurations  are  found  in  the  NASGRO  software  package  and  in  a  number  of  fracture 
references  (refs.  4,  20,  21 , 22,  and  23).  Close  configurations  are  used  to  estimate  the  maximum 
flaw  size  that  can  be  supported  during  the  expected  load.  The  following  cases  are  considered: 
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In  NASGRO  module  NASCCS,  ‘Critical  Crack  Size’,  Surface  Cracks 
SC01  and  SC02  (fig.  10).  Surface  cracks  are  given  in  terms  of  a  crack 
depth  to  width  ratio  (a/c).  Crack  depths  are  found  for  a/c  ratios  of  1 .0  and 
0.1 .  Both  SC01  and  SC02  include  variations  in  the  normal  tension  stress 
as  a  function  of  thickness.  For  cylindrical  parts,  the  stresses  s0  and  St 
in  figure  10  are  determined  from  the  stress  at  the  inside  and  outside  wall 
of  the  cylinder.  The  analysis  can  be  repeated  for  both  hoop  and  axial 
stress  components,  if  they  act  in  tension.  NASGRO  case  SC02  includes 
the  nonlinear  stress  variation  through  the  wall  thickness.  This  can  be 
taken  from  the  *odb  file  in  ABAQUS. 
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Figure  10 

NASGRO  (ref.  4)  surface  cracks  (copied  with  permission) 

•  NASGRO  Corner  Crack  CC01  is  used  for  notches  and  edges  (fig.  11). 

CC01 


So 


Figure  1 1 

NASGRO  corner  crack  CC01  (ref.  4),  varying  stresses 

For  cylindrical  geometries,  NASGRO  cases  SC04,  SC05,  and  SC06  are 
also  evaluated  as  shown  in  figure  12.  Surface  cracks  on  the  inside  and 
outside  of  the  part  are  considered.  Crack  SC03  applies  specifically  to 
spherical  pressure  vessel.  As  an  approximation,  the  group  uses  SC03 
for  cylindrical  parts  with  pressure  on  the  crack  surface. 
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SC06 

Internal  or  external  crack 
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NASGRO  (ref.  4)  surface  cracks  for  cylinders 


For  threaded  cylindrical  regions,  NASGRO  cases  SC08,  SC09,  and 
SC10  are  evaluated  (fig.  13). 
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Figure  13 

NASGRO  (ref.  4)  threaded  cylinders 

At  bolt  holes,  NASGRO  cases  SC1 1 ,  CC02,  CC04,  CC01 ,  TC03,  TC05, 
and  TC09  are  evaluated.  Some  of  these  cases  are  shown  in  figure  14. 
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Figure  14 

Some  of  the  NASGRO  (ref.  4)  cases  evaluated  at  a  hole 
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•  Other  cases  are  evaluated  using  a  FORTRAN  package  written  at  the 
U.S.  Army  Armament  Research,  Development  and  Engineering  Center, 
Picatinny  Arsenal,  New  Jersey.  The  FORTRAN  program  considers 
surface  cracks  and  cracks  in  cylinders  from  Anderson’s  Fracture 
Mechanics  {ret.  21)  book.  Generally,  Anderson’s  figures  12.2,  12.29, 
12.30,  and  12.31  are  evaluated  from  the  reference.  The  two  crack  cases 
in  Shighley  are  also  checked  (ref.  18).  References  23  and  24  are  used 
for  holes  with  cracks  on  one  or  two  sides  and  miscellaneous  plate 
problems. 

•  Many  of  the  critical  crack  locations  have  stresses  approaching  the  yield 
stress.  The  FORTRAN  program  includes  a  plate  with  a  surface  crack 
and  the  Irwin  plastic  zone  correction  (refs.  25  and  26).  The  program 
also  includes  a  part-through  crack  in  a  cylinder  with  the  Irwin  plastic 
zone  correction  (ref.  22). 

Step  6,  Recommend  Critical  Flaw  Sizes 

Critical  defect  sizes  can  be  recommended  at  different  high  stress  locations  and  for 
the  remaining  part.  Generally,  the  smallest  flaw  size  is  the  critical  size.  The  resulting  crack  map 
generally  specifies  a  crack  depth  that  is  half  of  the  size  recommended  by  the  design  team. 

For  most  critical  defect  locations,  the  different  geometry  assumptions  provide  similar 
critical  crack  size  estimates.  For  the  example  shown  in  figure  8,  the  following  cases  gave  similar 
critical  crack  sizes:  the  part-through  crack  in  a  plate  with  the  Irwin  correction,  the  part-through 
crack  in  a  cylinder  with  an  Irwin  correction,  NASGRO  SC01,  NASGRO  SC06,  NASGRO  CC01, 
and  NASGRO  EC01. 

Redesign  may  be  recommended  if  the  flaw  size  is  too  small  for  the  inspection  methods 
used  by  the  contractor.  For  instance,  one  of  Excalibur’s  contractors  uses  reference  27]  and 
inspects  for  defects  larger  than: 

•  a/c  =  1 .0,  a  =  1 .9  mm 

•  a/c  =  0.1,  a  =  0.56  mm 

A  recent  NASA  publication  on  dye-penetrant  tests  suggests  smaller  allowable  flaw  sizes  for  dye- 
penetrant  (ref.  28).  The  following  NASA  rejection  criteria  are  suggested  for  locations  where  a 
critical  defect  is  not  otherwise  specified: 

“a.  Linear  indications  -  all  linear  indications,  regardless  of  length,  shall  be  cause  for 
rejection  of  the  component. 

b.  Single  rounded  indications  -  a  single  rounded  indication  greater  than  0.030  inches  in 
diameter  shall  be  cause  for  rejection  of  the  component. 

c.  Multiple  rounded  indications  -  two  or  more  rounded  indications  each  less  than  0.030 
inches  in  diameter  but  separated  by  less  than  0.030  inches  shall  be  cause  for 
rejection  of  the  component.” 
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Similar  recommendations  could  be  applied  to  the  safety-critical  parts  of  gun-fired  components. 

Linear  elastic  fracture  mechanics  is  an  estimate  not  an  exact  prediction.  If  the  geometry 
and  loading  matches  the  theoretical  crack  assumptions  and  the  normal  stresses  do  not  exceed 
80%  of  yield,  then  the  critical  crack  predictions  are  probably  reasonable.  For  some  parts, 
elastic/plastic  fracture  mechanics  is  also  done.  Elastic/plastic  fracture  mechanics  is  more 
accurate,  since  it  is  completed  on  the  finite  element  geometry.  It  is  more  time  consuming  since 
each  crack  configuration  must  be  modeled  separately.  Elastic/plastic  analysis  may  be  done  if: 

•  The  normal  stress  exceeds  80%  of  yield 

•  The  match-up  in  theoretical  and  actual  geometries  is  poor 

•  The  critical  crack  size  is  too  small  for  the  vendors  non-destructive  evaluation 
method  and  a  double  check  of  the  crack  size  is  requested 

•  The  required  inspections  would  be  costly  and  a  large  critical  crack  size  might 
save  the  government  money 

Two  methods  of  elastic/plastic  fracture  are  available  in  ABAQUS  and  both  are  used.  The 

crack  can  be  modeled  with  singularities  at  the  crack  tip.  This  method  is  easier  to  implement  on  a 

flat  part.  ABAQUS  6.0  and  higher  has  automatic  meshing  to  map  in  the  elastic  and  elastic/plastic 
singularities.  The  chosen  crack  length  is  either  the  critical  crack  length  or  the  length  visible  by 
the  supplier’s  non-destructive  testing  technique.  The  method  must  be  repeated  for  each  different 
crack  configuration.  The  second  type  of  analysis  is  also  supported  by  ABAQUS  version  6.0  and 
higher  and  is  the  cohesive  stress  method  introduced  by  Dugdale  (ref.  29)  and  Barrenblatt  (ref. 
30).  This  method  can  be  implemented  on  cylindrical  geometries.  It  requires  a  relatively  fine 
mesh  and  different  crack  configurations  require  different  models. 


OPERATIONAL  FAILURE  CRITERIA  DUE  TO  TOLERANCE  VARIATION 

One  additional  structural  failure  is  checked  using  statistical  methods.  Precise  munitions 
have  sensors  and  mechanisms  that  must  deploy  or  activate  when  triggered,  generally  during  the 
flight.  Examples  include  the  fuze  safe  and  arm  (FSA)  device  and  sensors.  The  155-mm  M898 
SADARM  projectile  experienced  some  failures  when  its  thermal  sensors  failed  to  deploy  during 
some  shots.  Investigation  showed  that  when  several  tolerances  were  machined  near  to  their 
limit,  binding  occurred  and  the  lens  failed  to  activate.  To  improve  the  reliability  of  Excalibur, 
statistical  analysis  is  used  to  check  the  probability  of  a  tolerance  stack-up  failure  (refs.  5  and 
31). 


DEVELOPMENT  AND  EARLY  TESTING  FOR  RELIABLE  STRUCTURES 
Defining  Test  Failures  for  Reliable  Designs 

Testing  is  an  integral  part  of  designing  for  reliability.  In  the  early  stages  of  development, 
the  severe  testing  environment  results  in  early  failures,  redesign,  and  retesting.  With  hundreds 
of  parts,  variable  dynamics,  and  multiple  vendors,  failures  are  difficult  to  prevent.  Operational 
failures  are  easy  to  detect  -  the  munition  does  not  meet  a  key  performance  parameter.  Reliable 
munitions  require  a  broader  definition  of  failure: 


17 


•  Any  failure  to  operate  as  designed 

•  A  small  failure  that  might  vary  into  an  operational  failure 

Consider  the  Space  Shuttle  Columbia.  For  years,  small  pieces  of  foam  were  breaking  free 
without  causing  operational  failure.  In  February  2003,  a  large  chunk  broke  free  causing 
catastrophic  damage  (ref.  32).  The  Columbia  Accident  Review  Board  reported  that  “Foam  loss 
has  occurred  on  more  than  80%  of  the  79  missions  for  which  imagery  is  available  ...”  The  Space 
Shuttle  Challenger  had  a  similar  tragedy.  The  coldest  launch  of  a  space  shuttle  was  Space 
Shuttle  Challenger,  mission  51  -L,  which  occurred  at  36°F  (ref.  33).  The  Challenger  accident 
report  stated: 

“Of  21  launches  with  ambient  temperatures  of  61  degrees  Fahrenheit 
or  greater,  only  four  showed  signs  of  O-ring  thermal  distress;  i.e., 
erosion  or  blow-by  and  soot.  Each  of  the  launches  below  61  degrees 
Fahrenheit  resulted  in  one  or  more  O-rings  showing  signs  of  thermal 
distress.” 

Failure  of  the  O-rings  was  found  to  be  the  root  cause  of  the  Challenger  failure.  Both  space 
shuttle  disasters  were  preceded  by  non-operational  failures  similar  to  the  catastrophic  failure. 

It  is  important  for  the  designer  to  examine  successes  as  well  as  failures  to  assure  a  robust 
design.  The  fact  that  a  given  test  was  successful  does  not  mean  that  all  components  functioned 
as  designed  or  that  an  anomaly  did  not  occur.  The  prudent  designer  should  examine  all 
hardware  recovered  from  firings  and  verify  that  it  behaved  as  the  structural  model  predicted.  If  it 
did  not,  there  may  be  something  wrong  with  the  model  and  experience  has  taught  us  that 
innocuous  items  that  misbehaved  usually  end  up  as  full  blown  failures  later. 

Similar  warning  signs  have  been  noted  in  the  Excalibur  program.  Capacitors  and  chips 
noted  after  operational  successes  have  been  followed  by  similar  failures.  Similar  small 
difficulties  with  the  base  have  been  followed  by  more  substantial  difficulties. 

Figure  15  describes  a  lesson  learned  from  the  SADARM  program.  Again,  small  failures 
occurred  and  operation  was  otherwise  acceptable.  Eventually,  however,  the  small  failures 
escalated  into  operational  failures  and  sub-munitions  were  lost.  The  Key  Performance 
Parameter,  reliability,  for  SADARM  was  not  met. 
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SADARM  Lessons  Learned 
J.  Kalinowski,  December  2002 

1 .  Subject  Title:  Failure  to  implement  Corrective  Actions  (CAs) 

2.  Problem  Description:  During  SADARM  development  the  system  contractor  failed  to  implement  CAs  to 
hardware  that  was  not  functioning  as  designed  since  it  had  not  caused  a  system  failure. 

3.  Problem  Cause:  The  Despin,  Decelerate,  Orient  &  Spin  (DDO&S)  system  of  the  SADARM  submunition 
(SM)  was  not  functioning  as  designed.  During  early  testing,  video  coverage  of  the  descending  SADARM 
munition  (SM)  showed  the  Ram  Air  Inflated  Device  (RAID)  descending  in  the  vicinity  of  the  SM 
descending  under  the  Vortex  Ring  Parachute  (VRP).  Although  no  apparent  interaction  was  observed 
during  testing,  several  ’'close-calls"  were  noted.  The  system  contractor  felt  that  no  fix  was  necessary 
since  no  SM  failure  resulted  from  these  "close-calls".  During  subsequent  testing  these  "close-calls" 
became  direct  impacts  between  the  RAID  and  the  SM  under  the  VRP  which  resulted  in  wrapped  VRPs 
and  system  failures  for  the  SMs.  Although  system  failures  were  eminent,  it  wasn’t  until  the  occurrence  of 
"hard-failures"  that  the  system  contractor  took  action. 

In  addition,  this  condition  caused  the  SM  to  impact  the  ground  at  a  much  greater  velocity  than  it  would 
have  if  the  VRP  hadn't  wrapped.  This  condition  made  it  difficult  to  distinguish  between  electronics  failures 
due  to  gun  launch  and  ground  impact. 

4 .  Solution:  None.  Problems  were  not  addressed  until  ’’hard  failures ” occurred. 

5.  Future  problem  avoidance:  Conduct  Fault  Tree  Analysis  on  all  items  not  functioning  as  designed  as 
soon  as  the  deficiency  is  noted  and  implement  corrective  action  into  the  design  as  soon  as  possible. 

Fixing  deficiencies  early  allows  for  more  data  to  be  collected  on  the  fix  and  the  other  subsystems  to  be 
evaluated. 


Figure  15 

Lessons  learned,  failure  to  implement  corrections 
Investigate  Root  Cause  of  Failures 

There  is  no  point  in  fixing  the  wrong  problem  or  in  fixing  a  problem  incorrectly.  Root  cause 
investigations  provide  a  procedure  to  determine  the  source  of  a  failure  and  implement  changes 
to  keep  the  failure  from  recurring.  The  steps  include: 

1 .  Brain  storming  as  a  multi-discipline  team 

2.  Fault  tree  analysis 

3.  Definition  of  plausible  failure  sequences 

4.  Data  gathering 

5.  Assessing  refuting  and  supporting  data  for  plausible  failure  sequences 
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6.  Determination  of  the  likely  root  cause(s)  of  the  failure 

7.  Implementing  corrective  action 

The  process  often  uncovers  several  required  design  improvements. 

Redesign  to  Prevent  Future  Failures 

Late  in  the  design  process,  most  upgrades  are  process-specific  or  material  changes. 
Geometric  changes  are  more  difficult  to  implement.  For  the  material  changes,  the  root  cause 
(fracture,  yield,  or  buckling)  must  be  known.  If  fracture  is  the  root  cause,  choosing  a  higher- 
strength  material  may  result  in  reduced  toughness.  Choosing  a  higher-strength  steel,  if  the 
original  design  was  steel,  would  also  not  improve  a  buckling  problem.  Summarizing,  typical 
redesign  recommendations  include: 

•  Choosing  a  stronger  material  if  the  root  cause  of  failure  was  yielding 

•  Choosing  a  higher-modulus  material  if  the  root  cause  of  failure  was  buckling 

•  Choosing  a  tougher  material  if  the  root  cause  of  failure  was  fracture 

•  Clarify,  modify,  and  improve  the  manufacturing  process  to  reduce  variations 

•  Improve  quality  control  methods 

•  If  possible,  avoid  potting  materials  and  adhesives.  If  not  possible,  clarify  the 
process  to  reduce  variations 

•  Design  connections  so  they  can  not  shake  loose 

•  Avoid  adhering  materials  with  different  Young’s  moduli  or  different  coefficients 
of  expansion 

•  Avoid  rectangular  holes  and  sharp  corners 

•  Avoid  press  fits  or  consider  damage  tolerant  design  and  improved 
manufacturing  processes 

•  Avoid  designs  that  keep  highly  stressed  regions  in  tension  for  long  periods  of 
time 

Test  a  Statistically  Meaningful  Quantity 

Testing  is  expensive.  Firing  10  Excalibur  prototypes  at  Yuma  Proving  Ground  is 
expensive.  The  high  cost  of  testing  is  the  reason  for  finite  element  analysis  and  attention  to  the 
modes  of  failure  in  the  redesign  effort.  As  described  in  another  Lesson  Learned  from  the 
SADARM  program  (fig.  16),  tests  should  be  done  after  implementing  several  design  changes. 
With  reliability  goals  of  90%  and  greater,  it  is  recommended  that  at  least  10  munitions  be  tested 
to  validate  blocks  of  improvements. 
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SADARM  Lessons  Learned 
J.  Kalinowski,  December  2002 

1 .  Subject  Title:  Inadequate  test  quantities  masked  whether  or  not  the  fixes  were  effective. 

2.  Problem  Description:  During  SADARM  development,  the  effect  of  fixes  to  the  hardware  was  masked 
by  successes  demonstrated  on  small  sample  sizes. 

3.  Problem  Cause:  During  SADARM  development,  a  rigorous  test-fix-test  program  was  initiated.  During 
this  program  many  tests  were  conducted  at  high  charge  zones  to  precipitate  reliability  deficiencies.  Many 
of  these  tests  were  conducted  with  few  samples  (usually  less  than  five  projectiles).  Initially,  many  of  the 
fixes  appeared  to  be  effective  at  solving  the  deficiency.  This  success  however  was  short  lived  since  the 
same  problems  would  emerge  during  subsequent  test  iterations  (i.e.  FS&A,  IR  Telescope  deployment, 
etc.).  In  addition,  many  of  the  problems  that  we  were  trying  to  fix  were  failures  that  were  contributing  to 
less  than  10%  of  the  reliability  deficiency  (i.e.  low-occurrence  failures). 

4.  Solution:  Maximize  test  quantities  by  implementing  block-changes  to  the  hardware.  This  allows  several 
iterations  to  be  combined  which  allows  for  a  more  statistically  significant  sample  size  to  be  tested. 

Sample  sizes  should  demonstrate  the  statistical  success  of  fixes  to  the  hardware. 

5.  Future  problem  avoidance:  Testing  larger  quantities  by  implementing  block  changes  aids  in  reducing 

test  costs,  allows  for  a  better  evaluation  of  the  fix  by  providing  larger  sample  sizes,  and  reduces  the 
probability  of  a  marginal  fix  being  accepted  and  having  to  be  fixed  again. _ 


Figure  17 

Lesson  learned,  number  of  tests  required 


CONCLUSIONS 

For  more  reliable  smart  munitions,  the  following  recommendations  are  made: 

1 .  Do  finite  element  analysis  as  early  in  the  design  processes  as  possible 

2.  Verify  that  the  finite  element  results  are  realistic 

3.  Design  all  structures  to  resist  three  modes  of  structural  failure:  yield,  buckling, 
and  fracture 

4.  Use  damage  tolerant  design  for  all  safety-critical  components 

5.  For  parts  that  move,  use  statistics  to  check  tolerances  and  verify  motion 

6.  During  testing,  think  of  small  failures  or  anomalous  behavior  as  possible 
variations  of  larger  failures 

7.  Use  root  cause  analysis  to  determine  the  nature  of  the  failure  and  redesign  for 
the  failure  modes  that  occurred 

8.  Test  statistically  meaningful  quantities  to  verify  fixes 
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